Avast ANTIROOTKIT

system · 2017-01-15T18:52:10.000Z

Hello all
I downloaded Avast Antirootkit 0.9.6 and it executed it on my Windows 2008 R2 VPS server.
It found 29 items on HDD and masive amount of items in the registry, more then 5000 and it still works …
Is it safe to Delete all those items?
Thank you.

Pondus · 2017-01-15T18:54:10.000Z

Is it safe to Delete all those items?

Impossible to answer without the log

avast have a rootkits scanner (gmer) integrated in the AV engine and will perform a rootkit scan 8min after computer start

system · 2017-01-15T19:03:39.000Z

Hello
thank you for your answer.
I downloaded it from http://files.avast.com/files/beta/aswar.exe
and executed in the temp directory and it still running.
I see aswar.log file in program directory (it is currently about 2 MB) - do you need that file?
I did not restarted my server, just executed aswar.exe and clicked on Start scanning.
Thank you.

Pondus · 2017-01-15T19:21:55.000Z

do you need that file?

To answer your question, yes

Experts are notified but they are probably not online before tomorrow

why are you running a rootkit scan, any problems?

system · 2017-01-15T19:35:44.000Z

OK I will upload a log once scanning is finished.
Before few days I saw that Google Chrome will not run any more (it displayed sad face so I asked Google for help.
They answered I need to try run some malware software.
I tried many of them and noticed that some of them want to install specific driver by Windows boot - to test the system - but they failed.
Then I was 99% sure that I have something but only Avast Antirootkit actually said there are Rootkits.
It runs now for more then hour and found more then 8000 items so I’m waiting it to finish.
I suppose I need to purchase some license to remove them?
Could you please give me any info about that?
Thank you.

Pondus · 2017-01-15T19:41:32.000Z

I suppose I need to purchase some license to remove them?

No

when scan is finish, attach log, dont remove anything

also see here > https://forum.avast.com/index.php?topic=194892.0
Scroll down to second picture > Farbar recovery scan tool
Follow instructions and attach the two diagnostic logs

Then a expert will assist you tomorrow

system · 2017-01-15T19:52:11.000Z

OK will do so, thank you.

Rednose · 2017-01-15T20:12:16.000Z

Hi guys,

I just want to mention that aswar is a very old and obsolete version, you schould not use anymore.

Greetz, Red.

system · 2017-01-15T20:32:56.000Z

Is there any other Rootkit scanner for Windows Server 2008?
Thank you.

Eddy · 2017-01-15T21:09:44.000Z

There are searchengines

If you are running a server and need to ask the things you did here, I suggest you hire a real admin.

system · 2017-01-15T22:27:03.000Z

Hello
I did try other rootkit scanners but they can not run because they can not install some driver when booting. Only Avast was able to find them…
What real admin I need to hire? Could you please give me more info’s?
Thank you.

dbrisendine · 2017-01-17T07:32:24.000Z

Eddy post:10:

There are searchengines

If you are running a server and need to ask the things you did here, I suggest you hire a real admin.

I think the question is, why are you running Windows Server 2008? Are you providing services to users or just running a no-cost OS?

system · 2017-01-18T08:43:36.000Z

I’m running VPS and there is Server 2008 installed.

Pondus · 2017-01-18T08:46:03.000Z

for help, attach the requested logs

system · 2017-01-18T10:16:20.000Z

Pondus post:14:

for help, attach the requested logs

Hello
I sent you a PM.
Thank you.

Eddy · 2017-01-18T10:39:18.000Z

Attach the log files to your post here.

dbrisendine · 2017-01-18T16:20:46.000Z

Thanks for the log files but I am not going to download files from a unsecured, 3rd-party site.
This is a VIRTUAL machine. None of Avast’s scanners are designed to work on a virtual system. You could see if a scan with TDSSkiller finds anything; it does not need a reboot to scan the system. However, if it does scan, the software will most likely find every file suspicious as the files’ characteristics are not the ones expected due to the system running in a Virtual container.
Being a virtual system, why not restart the server with a fresh image? Or re-install Chrome to see if that fixes the Chrome issue?

system · 2017-01-18T17:02:25.000Z

Hello
that’s 3 txt files inside ZIP archive, nothing else. Do you have other option where I can upload the file? I can not post my log files to public.
TDSSkiller was not found anything but it can not install boot driver, just like MallWarebyte and other I try. I suppose it is because of virtual file system?
I can not install any fresh image because I have running programs, database etc. I’m aware that I can move them to new VPS but if possible, I will try to clean current system.
I reinstalled Chrome many times, it does not work. Chrome is not important at this moment.
Thank you for any help.

system · 2017-01-19T08:17:07.000Z

Does anyone want to help?
I can send log files on PM.
Thank you.

dbrisendine · 2017-01-21T07:17:25.000Z

I will look at the log files PROVIDED my malware scanners say the file(s) are safe. What scanner produced these logs?

Announcements